Assurance IT invited our favorite ethical hacker, Laurent Desaulniers. In this episode, Laurent Desaulniers, Security Cloud Manager, and co-founder of Assurance IT, Luigi Tiano, discuss:

1. What does ethical hacking really mean?

2. Should pentests be done multiple times per year?

3. Who was Mafia Boy?

4. How did he give ethical hacking a bad name?

5. What will the lack of IT talent result in?

6. The truth behind the ethical hacking community

7. What are some ways to get started in ethical hacking?

8. How do you identify great hacking talent?

9. The #1 question to ask ethical hackers in interviews.

10. How much money you can make as an ethical hacker.

BONUS TOPICS

What schools should really be teaching about tech?

Resources for learning cyber security.

Resources:

Laurent Desaulniers’s LinkedIn: https://www.linkedin.com/in/laurentdesaulniers/

Luigi Tiano’s LinkedIn: https://www.linkedin.com/in/luigitiano/

Assurance IT Website: http://www.assuranceit.ca/

About Laurent Desaulniers:

Laurent Desaulniers combines a strong technical experience with creative thinking to achieve elegant solutions with a passion for security, especially forensic, web and penetration testing.

Laurent Desaulniers is knowledgeable in the following technologies :

- Operating systems: Linux (Ubuntu/Debian) , Windows (2008, 2003 Server, Windows 2000 Server), Cisco IOS

- Programming languages: PHP, Javascript, Python, Java (J2EE, EJB3, Servlet, Swing), JSP, Struts

- Framework: PCI-DSS, ISO-27001, ISO27034, ISO17799, ISO13335, ITIL, COBIT.

- Methodology: OSSTM, OWASP, OCTAVE

- Security: IDS systems, Honeypots, Penetration Testing

Specialties: Forensic, Web application intrusion, Vulnerability Analysis

About 10 Questions to Cyber Resilience:

Twice per month, learn about how IT leaders are strengthening their cyber security practices. Every episode comprises of 10 questions that get you one step closer to cyber resilience. Subscribe to stay up-to-date with hot topics in cyber security.

About Assurance IT:

Assurance IT (www.assuranceit.ca) specializing in data protection and data privacy for the mid-market in Canada, since 2011. The Montreal-based company’s unique approach to helping customers become cyber resilient is called the PPR Methodology which stands for Prepare, Protect and Recover. Based on industry best practices, the PPR Methodology is an easier way to achieve cyber security and compliance objectives.

Thanks for joining us here

today, Laurent, on our podcast.

Really excited to have you on.

Let's go ahead and start Laurent.

Who are you, what do

you do, and what got you

to where you are today?

So my name is Laurent Desaulniers.

I'm a vice president at GoSecure.

I manage two teams, so I manage

the incident response team as well

as the penetration testing team.

So I have a team that breaks

into building applications that

does all the hacking stuff.

Whereas I have a team that answers

this problem and try to solves

it on behalf of our client.

So that's basically it.

What I'm doing I've been doing

this for 15 to 20 years, depending

how you count and I've been

also been lucky to be allowed

to teach, so I've taught this in

three universities in Montreal.

So that's pretty much all there is.

And who do you work

for today, Laurent?

I work for GoSecure which is

a MXDR and a service company.

So we're doing pen testing

and also managing xdr.

So managing all the endpoints and

making detection and response.

I noticed that if I look back

at your profile, you've been

doing this a very long time.

And you're actually

pretty young guy.

So it's pretty interesting.

You've probably seen a

tremendous evolution of

security happen over the years.

My first question I have

for you is a lot of people

talk about ethical hacking.

So can, can Laurent really

simplify what is ethical hacking?

So ethical hacking, ethical

is at least important, if not

much more so than hacking.

So what we're doing mostly is

being hired to break into a system.

And we do it based on what are

called rules of engagement.

So we make sure we follow, respect

the rules, we don't actually

break things for the client,

and that's what we're doing.

The ethical aspect though

is super important.

Think about the level of trust

the company needs to have in

you, to allow you to perform

these type of tests or get access

to passport data or get access

to social security numbers.

As a tester, you need to be

above doubt and above suspicion

for any form of testing, and

that's the only way you can

get business is by being above

reproach and above any doubt

regarding your ethical integrity.

So in ethical hacking, there's a

hacking part and ethical part, and

some of it is what we're doing.

And in your opinion, ethical

hacking, does this apply to

small business, large business?

Who should be taking on

or actually requesting an

ethical hacking service?

Nowadays we see more and

more pen testing performed

across all systems.

It started more in the

where there was money.

So banks, for example, like early

2000, mostly banks and militaries

were performing pen testing.

Now with compliance framework

and people say Bill 25 in Quebec

but there's one in British Columbia

as well that now makes it mandatory

to have protection, there's gdpr.

So now there's more

and more privacy based

compliance rules and laws.

That is one reason why there

is more and more pen testing.

Same for credit card data

compliance based like P C

I, for example, that also

makes pen testing mandatory

for these industries.

So I think the main drive

across organizations for pen

testing is still compliance, but

we're seeing now more and more

companies doing risk management,

they don't wanna do it just to

comply to the framework, but

they wanna do it to find their

actual risk and be able to find

ways to mitigate these problems,

mitigate their risk.

We see that often now.

And oftentimes you

mentioned compliance.

We're seeing a lot more from the

cyber insurance perspective where

cyber insurance companies are

forcing companies who may not have

the same maturity level as those

companies you mentioned earlier.

The cyber insurance companies

are forcing enterprises to

just become more mature.

And Ethical hacking is obviously

a fundamental way for companies

to really get an understanding of

where they are in their process.

Is that an accurate statement?

It's absolutely correct.

Insurance has been a big

driver, but there's a big

change in cyber insurance.

I think the industry is becoming

more mature and few years ago

it was you sign a contract,

sent a file, you were done.

Now there's much more audits to

subscribe to cyber insurance,

and I think it's a good

thing that all these controls

are in place better prevent

I, I agree with that.

And to your point, I think it's

gonna be more difficult and I

think it's gonna be more rigor.

And I think it won't be one

time a year where you sign off,

it'll be multiple times a year

and then on a regular basis to

make sure that you're actually

keeping those controls in place.

I think that's where

we're gonna see more.

I don't think the insurance

companies have what it takes

to do that repetitively

often enough to make sure

their customers are in line.

But I think at some level

we're gonna see more of that.

I wanna stick in the ethical

hacking vein because you and I

obviously, raised in Quebec here.

And there's a very famous

individual who I guess,

Maybe made ethical hacking a

little bit famous earlier on.

And so ethical hackers,

sometimes get a bad reputation.

And we have a local famous

character named Mafia Boy.

For those who don't know,

maybe can you remind us,

what Mafia Boy did and how he

impacted the industry today?

So Michael Calce AKA Mafia

boy was the teen in Ile Bizard

Montreal, who performed denial

of service on many systems.

Yahoo was very big at a

time and Yahoo was down

thanks to his efforts.

Same for eBay was also down, so he

brought down lots of systems using

distributed denial of service.

If I had to qualify the

threat Michael Calce was

on the lower end of sophistication,

he used a tool and there was

little to no privacy impact that

he didn't show much, although we

can all agree impact was high.

This is not what I would

call ethical hacking,

nor ethical, by the way.

Cause there were no prior

permissions nor hacking per

se, as he mostly used the tool.

So there's no discovery, no impact

analysis, none of these things.

But it's really interesting

because when you look

into end of the century.

So like the 1990s that's

how you got hired.

So at that point, if you hacked

into NASA and you got caught and

you spent a few months or years in

jail, then they knew you were good.

Obviously you hacked into NASA.

One could argue that if

you got caught, perhaps

you weren't so good.

But at that point, that's

how the business worked.

keep in mind, there were no

certifications at that point.

There was no frameworks of ethics.

It was barely known now the

industry has really evolved.

Nowadays,

there are CTFs, there are

certification, there are

mentorship, there are schools.

there are Bug Bounties.

There's lots of ways for people

to show their skills but at that

time, that's how people got hired

was by breaking into systems.

It's a really different it's

not 30 more years ago, but yeah.

That's how people got it.

Yeah.

People forget.

So Mafia Boy, I think he hit those

companies in I think 2000, right?

Yeah.

And the probably there wasn't the

level of sophistication in terms

of security as there is today.

And to your point, I think

his attack was a really low

level, not really sophisticated

way of attacking systems.

That's absolutely correct.

And that's how we've seen that

the industry evolve over time.

We talk a lot about ethical

hacking and the, the

industry and, and the field.

From my vantage point and, talking

with customers and, I wanna

get your perspective on this

is there a shortage of talent

out there today as we speak?

There's a shortage in

ethical hacking, but there's

a shortage in governance.

There's a shortage in architecture.

There's a shortage in CIS admins,

in DBAs, in software developers.

Yeah, there's lots of shortages

and these things have an

impact because say you have

your system administrators have

more work then perhaps patching or

security configuration will be less

of a priority over other things

that are either more related to

the mission or of the organization

or more business critical.

So that opens more

doors for a hacker.

So your threat increases.

So not only I feel not enough

people to perform these

tests and it's difficult to

come with the right level of

training, but also the lack

of the database administrator.

System administrator

also opens more door.

So it's like a catch 22 where the

lack of people creates a problem.

Interesting.

And then we see that

across the board.

So if we look at specifically

though ethical hacking, cause we

wanna educate our audience here.

Ethical hacking.

How has that progressed from

your early days till now?

Have you seen an uptick or

an increase in interest?

Is it a domain where, it's

easy to access the tools.

There's obviously a growing

community, so maybe talk

to us a little bit about

how ethical hacking is

progress in the community.

Let me first say that the

community in Canada is amazing.

It's really something

we ought to be proud of.

Now there are many ways

to break into computer

security and to learn.

One problem that I feel is

what is called gatekeeping.

So since security is considered

to be very important or mission

critical, we quite often see

job posting for a entry level

pen tester that require five

to seven years of experience,

and that's a bit insane.

After five to seven

years, in theory, you're

not a beginner anymore.

So there's lots of gating.

It's quite difficult to break into

computer security because of the

way these job postings are made and

also because the way people learn.

Not all pen testers

have bachelor degrees.

Thankfully, computer security

is something that can be

learned by on your own with

CTFs or capture the flags with

competitions, with bug bounties,

with training online, like

Hack the Box for example.

That's a website where you

can learn to hack systems.

So there's lots of ways for people

to learn it by themselves and

be very good despite not having

a bachelor or master degrees.

But with HR oftentimes,

it doesn't match that the

requirement oftentimes are for

diplomas, and this is not what

all typical pen testers have.

There's also certifications.

I'm a big proponent of a

certification called O S C

P, the Offensive Security

Certified Professional.

It's a hands-on exam and all the

testers on my team are OSCPs.

It's a requirement for my

team cuz it's hands-on.

So it sets the level, but

that's one way also to learn.

But there are also communities.

So in Montreal there's

MontréHack, that's a monthly

security training, evening.

There are DEFCON 416 in Toronto.

There's a very big community

in Vancouver as well.

So there's lots of groups

where you can learn.

Now there's mentor-mentee.

In Quebec we have Academos

where we have lots of people

who are there to help answer

questions and be a mentor.

There are mentorship

opportunities as well.

So there's lots of ways

to get to know people and

get to know the business.

And there's also

special interest group.

There's ekka for people doing

audit, there's OWASP, there's

OWASP Toronto there, OWASP

Ottawa for example, that are

groups that focus on AppSec.

That is also a good way to

learn and get to know people.

Yeah you've shared a lot of

information and what we'll do

is I'll probably ask you to

send us some of those links,

so we can include them in the

post, cuz that's important.

I didn't know there was such

a huge community out there

and it is a really important

role in the enterprise today.

And I'll just touch

on something you said.

So you're big on certifications.

Frankly I believe the same thing.

Obviously school going through

the proper channels in the school

obviously is really important.

But I think in our field,

if you're not constantly

improving yourself, you can

get outdated pretty quickly.

So those certifications,

are proving to your, to your

employer and to your clients

that you're able to keep

up with the industry trends

because they are ever changing

as we've seen in our business.

But it's one way cause

sometimes training as well is

a way that doesn't necessarily

lead to certification.

But say, when I look at the resume

things for me that are a big plus

are capture the flag experience.

So CTFs, I briefly talked about it,

it's a right hacking competition

where you get to hack things

legally that are made to be hacked.

And so there are

lots of competition.

One is very big in

Montreal called NorthSec.

There's Defcon,

there's a quite a few.

So for me, having

hands-on CTF experience is

something I'm looking at.

But also like GitHub.

So if you have a GitHub

or GitLab account and you

commit code, then you make

changes, it shows your skill.

You're not just saying,

I'm a developer.

We can read your code, we

can see what you've done.

Being in the community is

also something that I look at.

And these are all techniques

where you can show growth.

It's also a common

interview question.

How do you keep up to

date in IT security?

I pretty much ask it in

every interview and you

get interesting answers.

The one you don't wanna

answer is, oh, I don't know.

I don't need to or don't follow.

Yeah, not a good answer.

It makes your day a lot

easier and a lot quicker.

I can understand that.

When did you participate in

your first capture the flag?

in, In 2000?

Was there a lot of these?

When did they start

coming into light?

So the team I was with and myself

started perhaps early 2007.

I think.

So there was a competition in

Montreal called, Boule de cristal.

We did a competition in Germany

that was very difficult.

I was at ets or local

University of Montreal.

But the competition was in Germany.

It was insane.

I think, there were 300 teams and I

think we finished 295 or something.

We were really bad at that point.

And we grew from this.

We did the Firefox

CTF we finished first.

We did the Defcon Quals,

so those are very large

competitions and then we

started doing more and more.

At some point, we did one

every other weekend roughly.

And that's how we kept doing ctf.

Now I'm an organizer of a ctf.

Now I'm on the other side.

Congratulations.

It looks like you're really

involved in the community, and I

think we need more individuals like

that, dedicated people, because, I

think it's a win-win first of all.

Obviously you're giving back

to the community, but if you're

looking for talent, you're in the

mix of it all the time, right?

So you know who the top

players could potentially

be, which is amazing.

As an ethical hacker,

obviously you don't start off

day one as ethical hacker.

I think as you mentioned, you

need to build your experience.

So what does a career look

like and what can an ethical

hacker earn on average?

And I know it's a tough question,

but if you can answer that.

So these amounts are set in

Canada because in United States

or with very large companies, I

know that the Microsoft of these

worlds, or Amazon of these worlds

sometimes have much bigger salary.

But in Canada, roughly, an

entry level pen tester will do

roughly 70 to 75,000 a year.

Mid-level, I'd say a hundred, 110.

And I think the more senior

10, 15 years, it might go up

to 160,000 a year roughly.

That's a very good living.

That's a very good living.

It's okay.

There are outliers though,

for example, bug bounty.

So bug bounty is when some

companies pay you to hack.

They only pay if

you find something.

And we have x employees who

now are doing surf and doing

bug bounty, half the time

their like doing surf and

having a very good living and

it's much higher than this.

That's roughly the

salary you can expect.

Again, there are outliers

for very large companies.

Yeah, those are good numbers,

especially, if you mentioned

entry level to very senior.

So it's a pretty big gap.

But I think in IT, and any field,

with experience I think we're

dually paid for what we do,

and I think organizations are

starting to see the real value

of IT professionals, especially

in the security business.

Again we wanna encourage more folks

to get into the security space.

Absolutely.

Yes.

So it leads me to my last

question, my last point.

But you mentioned earlier

you were a lecturer in

universities and schools.

This is my opinion, and

I'd like to get yours.

I think we're not devoting or

dedicating enough education

at the lower levels of school,

of the institutions to start

putting this into the children's

curriculum at some level.

I think cybersecurity, maybe

not necessarily cybersecurity

but security in general about

the digital security, I think

needs to be employed more in

the educational institutions.

You lived there.

You obviously spent some

time there lecturing.

What's your opinion about that

and what can we do better to get

more into the educational system?

It's a very interesting thought.

I'll try to break it

in sub categories.

So I was very impressed

about what people learn in

primary and high school now.

There are programming

classes and robotics classes.

It's mostly entry level, but

being familiar with programming

languages, is the cornerstone

of IT security to be able

to craft your own systems.

So in order to have very qualified

internet citizens giving them

their skills early is a very good

thing, and this is fairly recent.

We have yet to see what's gonna be

the impact later on because those

people who are in high school,

they're not on the market yet.

But I know there's a really

big increase into, giving

these types of training in

robotics and programming.

The people will play with

arduinos and Raspberry Pi at

the very early age, and I think

this is a really exciting.

It will change the

market in a few years.

Interesting perspective

As for security,

there are twofolds.

I've been asked several times

to give classes for privacy

and intimate picture exchange

because in high school

that's a problem oftentimes.

But it's more about

privacy and awareness.

So it's not very technical.

It's more about be mindful

of what you're doing, privacy

online and these type of things,

but it's something I'm asked

a few times a year already and

believe me, the kids are smart.

It's a little bit awkward at

first, it's an intimate subject,

but the students are interested

and they ask smart questions

and they understand really well.

I think it would be a mistake

to underestimate their

interest and their capacity

to learn in that regard.

But turning them in security at

some point, I feel that security is

amazing, but we don't want to scare

people into dealing with all these

amazing technology and programming

and the web and making queries.

So I think while there should be

more awareness and more than just

have a good password and have your

patches on, but more about, what

phishing looks like and what to do

when you have phishing or what's

important not to run as admin.

Like more targeted advice, I think.

At least let the kids be kids

and perhaps wait a little bit

longer into giving the internet

scary part, just, I think we

can wait a bit but give them

IT training and that's what

they're doing in high school

and I'm very happy about this.

Yeah, I like that.

I like that.

I never looked at it

in that perspective.

So the IT training is

the foundation and not

necessarily have to give them

all the ugly, scary stuff.

Correct.

That's my opinion.

Okay.

No.

Interesting.

But you're right.

I think if we give them the

fundamentals of understanding

to at least, why IT is

important, how it enables

them in their everyday life.

But I think there's the aspect

of privacy, which I think,

without having to get too

technical, like you mentioned.

If you're describing the risks

of not being private or giving

too much information out there,

I think that alone, without

having to get too technical,

should put some thought into

their brain about, keeping

some information to themselves.

Cause I think that's where-

interesting threat models,

like one of the threat

model is their parent.

When you ask questions, when

we think about privacy, you and

I, we think about online ads.

We think about,

these type of things.

But they have a very real

business threat model.

Their parents and their

teachers . So when you're

thinking about this, it gets

really interesting, really fast.

If you can have a talk

with a 12 or 13 years old

about their privacy model.

It's interesting.

It really is.

Yeah.

You've definitely put some things

into my brain today about that.

I appreciate that.

Laurent, is there anything you

wanna share before we go here?

Because I really wanna

respect your time.

is there anything you wanna

say about ethical hacking?

What you would recommend if

someone wants to get started,

what you need to get started?

Ethical hacking has two sites.

There's oftentimes what we call

the AppSec and the networking site.

If you want to break into

AppSec, there's this amazing

book called The Web Application

Hacker Handbook Second Edition.

That for me, is the most

amazing book about AppSec.

It's hands-on, you can try it on.

It's really something I can

strongly advise you to read, and

I know it's counterintuitive or

now in 2023 and I'm saying read a

book, but it's a very good book.

Also, there's a website that is

free as well called PortSwigger

Academy, where you can try

lots of these attacks and you

always have three level, like

easy, medium, and difficult.

And the difficult

challenges are difficult.

So, you need to have

your thinking cap on.

It's a pretty difficult challenge.

So these two things, somebody

who went through the whole

PortSwigger Academy application,

for me, somebody I would certainly

consider hiring that's for

sure on the networking side.

There are websites like Hack the

Box that you might wanna try.

The O S C P really cannot

recommend it enough,

although it's a bit costly.

And yeah, that's pretty much what

I would recommend to start into a

computer security and find mentors.

Reach out to me, reach out

to you, Luigi, if you, , I

put you on the spot.

Sorry.

But

, No, no problem.

If you're willing, I think

reaching out to seniors people

who know who've done it before.

If I may I have a little

anecdote for one minute.

Please.

Go ahead.

How I got into computer

security is interesting.

When I was in high school,

you need to pick what you

want to do, and I knew I

wanted to break into systems.

I didn't know that it was a job

at that point, and I wanted to

talk with people, but didn't

have any contacts in that field.

Keep in mind, early 1990s,

there were no certifications,

there was nothing.

So the CISSP certification

had just started and

the list was public.

There were eight people

who were CISSPs in Canada.

As a young kid, who barely

spoke English, I called

these eight numbers saying,

Hey, I wanna do hacking.

What do I do next?

And I got ignored by

seven out of them.

But one person answered.

And that person, his name is Robert

G, sadly, he's deceased right now.

And he was the CSO of

the bank of Montreal.

So this guy took two hours with

me and just to walk me through

the steps of what I should

do, should I do certification,

should I go to university?

And it was really worth it.

And the reason why I'm in

computer security, to be

truthful, is thanks to him.

If we can have that influence

over other people who want to

break into that field, I think

we have a responsibility to do.

That's amazing story.

Very nice to hear.

So there was eight CISSPs in

the early nineties in Quebec.

Wow.

And how many would you

say, roughly in Canada?

In Canada?

How many are there today, roughly?

I don't, now it's public,

but I'd say roughly.

Perhaps 10,000.

20,000.

Oh wow.

That many Wow.

Shows how the industry's grown.

Interesting.

Laurent, that was a great story.

Appreciate that.

And you know what, if we can

definitely be mentors to some of

the younger folks out there, I

would definitely, welcome that.

Laurent, you've been

an amazing guest.

Keep doing what you're doing.

I know you're protecting

companies on a daily basis and

GoSecure is lucky to have you.

So I want to thank you again for

joining us on the podcast and

we will be in touch very soon..

Thank you so much.

All right, Lauren.

Have a great day.

Thanks.

Bye.

Thank you.